Texas Cyber Command Opens Watershed 250 to Additional Vendors

Texas Cyber Command (TXCC) is seeking additional cybersecurity vendors to participate in Project Watershed 250, opening a formal application process for companies willing to provide no-cost assessments, remediation assistance and defensive services to Texas water and wastewater utilities.

Applications received by 5 p.m. Sept. 30 will be considered during the initial review. The command plans to continue accepting applications on a rolling basis until the pilot reaches capacity or the response period closes. The program period is scheduled to run from Nov. 1 through April 30, 2027, though TXCC may extend it to allow committed services to be completed.

The request seeks vendors capable of assessing information technology and operational technology environments, including cybersecurity posture, architecture, configuration, vulnerabilities and risk. Participating companies may also provide remediation support, validation, retesting, training and defensive tools or services within an approved scope.

TXCC said it is particularly interested in additional project management support, including schedule coordination, risk and issue management, progress reporting, performance metrics and closeout documentation. Vendors must identify how many assessments they can support, where they can operate and how long those assessments are expected to take.

The command will review applicants based on qualifications, methods, tools, capacity, availability, geographic fit and alignment with utility needs. TXCC will facilitate introductions, but each participating utility will select its own cybersecurity assessor and establish the scope, access rules and data-handling requirements before work begins.

The request also sets limits on what participating vendors can do. Companies cannot access utility systems, conduct scanning or testing, deploy tools or make production changes without written authorization from the utility. Vendors also cannot condition free services on a purchase, subscription, sales meeting or future commercial commitment.

Data collected through the pilot could also inform the state’s broader understanding of cybersecurity conditions across the water sector. Participating utilities will authorize selected assessors to provide agreed-upon telemetry and outcome data to TXCC, which may include assessment results, public Internet addresses, network maps, site locations and stakeholder information. The request says that information may also be shared with the White House Office of the National Cyber Director and the Office of the Texas Governor.

TXCC said it may use the information to evaluate cybersecurity challenges affecting Texas water systems and measure the pilot’s effectiveness, value and potential scalability.

The application also requires vendors to disclose any tools or agents they plan to use, where collected data would be stored, retention periods, cloud services, artificial intelligence use, remote-access requirements, subprocessors and proposed data-deletion methods. Vendors must also identify potential post-pilot costs, future license requirements or other expenses that participating utilities could face.

Project Watershed 250 is not a procurement for paid services and does not guarantee future business, reimbursement or consideration in later procurements.